Trust, Failure, and Release: Where Desktop Draws the Line

DSH Desktop’s security and reliability story becomes clear only when its boundaries are separated. This chapter asks four different questions: who can reach the local DSH service, what the renderer can call directly, what data chosen providers may receive, and what evidence is enough to call a generation healthy. It then follows the same discipline through renderer recovery and updates, so readers can judge the application’s controls without collapsing “local,” “sandboxed,” “recovered,” and “authentic” into one promise.

The product is designed to make DeepSeek Harness easier to operate, not to make every component trustworthy by default. Desktop can constrain its own window and update paths, but the Host still composes plugins that run locally, and a user can deliberately connect models, tools, registries, catalogs, and other services. The useful assessment therefore begins with reachability and ends with residual risk.

Reachability is not authentication

The normal DSH Web service listens on 127.0.0.1. That default matters because it keeps the ordinary carrier reachable from the same machine rather than advertising it to every device on the network. DSH Desktop’s native renderer receives the local page for the active generation, and the Host can distinguish that renderer with a generation-scoped, unpredictable request capability. Ordinary browser access is a separate choice rather than an accidental consequence of opening a local port.

These controls address different threats. Loopback limits where a request can originate. The renderer capability helps the Host distinguish the intended Electron surface from an ordinary browser request. Exact-origin navigation keeps the mounted window from becoming an arbitrary remote browser. Neither control answers whether a locally installed plugin is safe, whether a child process will misuse its permissions, or whether a user has intentionally configured a provider to receive sensitive content.

The native window has its own restrictions. Main-frame navigation and redirects are kept on the exact local origin; ordinary HTTP, HTTPS, and mail links are handed to the operating system. Desktop-created utility windows use context isolation, disable Node integration, enable the Chromium sandbox and web security, deny popups, and prevent WebView attachment. Together, these rules reduce the renderer’s direct access to the operating system and limit the places where untrusted page content can introduce another browsing context.

But a renderer sandbox is not a plugin sandbox. DSH Desktop’s Host runs upstream DSH services, Desktop services, and third-party plugins in the local composition. Those plugins and their dependencies execute with the permissions of their local processes. A public service contract can stop an author from depending on private Electron objects, but it cannot turn ordinary in-process JavaScript into an isolated security domain. That distinction is especially important when the project’s ecosystem manifesto discusses future capability and manifest standards: a declared capability is not evidence of technical permission enforcement unless the Host provides real isolation.

LAN exposure makes the difference even more concrete. If the user explicitly enables it, the Host can listen on network interfaces beyond loopback. The project warns that this exposure has no user authentication and can let someone on the local network create sessions or operate the computer through the DSH capabilities available to that connection. A confirmation prompt changes the user’s authorization decision; it does not add an account system. Certificate or HTTPS handling can protect transport properties, but it does not establish who is allowed to use the Host.

The correct judgment is conditional. Loopback is a safer default than an all-interface bind for a local application, and origin and renderer restrictions reduce direct attack surface. However, the risk model changes sharply when LAN access is enabled, when a third-party plugin is installed, or when a local process already has the user’s permissions.